Yes, they are correct in that there is no law requiring a banner popup. Functional cookies are always allowed, and you could always default to just not track people so you don’t need their consent either.

But if you want the user to give consent for the tracking cookies, and basically any site with advertisements really wants you to, then the popup is required, because the alternative - a disclaiming saying “by continuing to use you give consent bla bla bla” - has been deemed illegal. You need to get the user to actively opt-in to them and press I accept, and that means you nag at them with a popup. DNT header was a fantastic idea, for the users. Of course they didn’t want to use it, as it would have to also be opt-in (and so default to do not track) and probably 99.9% of browser users never change the default settings.

So while there is no law that says “you need a cookie consent popup”, there also effectively is.

They really need to make do not track binding by law.